@deployfoundation/foundation-deploy 0.2.50 → 0.2.52

package/README.md

@@ -54,9 +54,12 @@ bun run packages/infra/bin/foundation-deploy.ts <command> --instance <path>
 | `github-app-create` | Create the instance's GitHub App from the shipped manifest template. |
 | `slack-manifest` | Print the instance's Slack app manifest as JSON (the Slack CLI's `get-manifest` hook contract). |
 | `stage-customization` | Validate and stage a tenant-owned runtime config. |
+| `crm-key` | Write the company CRM's `crm/1` key, piped in with `--stdin`, into `<secretPrefix>/crm/http` (`crm.provider` kind `http`). |
+| `crm-check` | Run the `crm/1` conformance suite: the read cases against the instance's CRM with its stored key, or, with `--base-url --tenant --key-stdin` and no instance, any server, write cases included. |
+| `crm-replay` | Replay the agent's CRM writes (JSONL) into the instance's own table after a rollback to the DynamoDB provider. |
 
 `--instance <path>` is required for every command (or `FOUNDATION_INSTANCE_FILE`
-in a pipeline). There is no instance *name*, no `instances/` directory and no
+in a pipeline), except `crm-check --base-url`, which checks a server rather than a deployment. There is no instance *name*, no `instances/` directory and no
 default: a deploy that guessed its target would be a deploy into the wrong
 account.
 

package/agent-image/Dockerfile

@@ -20,6 +20,8 @@
 #     playwright-core 1.63.0 (exact pins + frozen lockfile in
 #     packages/infra/agent-image/open-slide/), whose Chrome Headless Shell
 #     build is pinned by the playwright-core version
+#   - Node.js 24.22.1 (LTS) with npm, and pnpm through corepack, for the
+#     repositories the agent clones and tests (see the node-provider stage)
 #
 # Secrets bootstrap: the container receives ONE pointer env var,
 # RUNTIME_SECRET_ID. At start, server.ts fetches that JSON secret from Secrets
@@ -40,6 +42,9 @@ ARG GH_VERSION=2.97.0
 # no ECR access; a deploy pipeline can override it with a mirrored tag to stay
 # clear of Docker Hub's anonymous rate limit.
 ARG BUN_IMAGE=oven/bun:1.4.0-slim
+# NODE_IMAGE: where the real Node.js comes from (node-provider stage). AWS's
+# mirror of the Docker official image, like golang below.
+ARG NODE_IMAGE=public.ecr.aws/docker/library/node:24.22.1-trixie-slim
 # GH_IMAGE: where the gh BINARY comes from. The default names the `gh-source`
 # stage below, so a local build compiles it; an override points at a prebuilt
 # image, and under BuildKit an unreferenced stage never runs — which takes the
@@ -129,6 +134,15 @@ COPY skills/slides/export_deck.mjs skills/slides/starter.tsx ./
 # below is what makes the choice load-bearing.
 FROM ${GH_IMAGE} AS gh-provider
 
+# --- Node.js (repositories the agent works in) -------------------------------
+# The bun base ships only Bun's `node` shim (/usr/local/bun-node-fallback-bin),
+# which refuses real Node invocations ("Missing script to execute"). Turns in a
+# Node repository then began by downloading and unpacking a Node tarball before
+# they could typecheck or test anything (Olivia, every PR turn, 2026-10). The
+# runtime stage copies the official build's binary and its bundled npm and
+# corepack from here; nothing else from this image is used.
+FROM ${NODE_IMAGE} AS node-provider
+
 # --- runtime ----------------------------------------------------------------
 FROM ${BUN_IMAGE}
 
@@ -142,8 +156,12 @@ ARG FOUNDATION_GITHUB_APP_ID=0
 # credential probe checks — without this pointer the omp Bedrock provider
 # refuses with "No API key found". The real IMDS control is the tool policy
 # denying 169.254.169.254, not an env var a raw curl could ignore.
+#
+# No NODE_ENV=production: nothing in Foundation reads it (the install below
+# passes --production itself), and the agent's shell inherits the container
+# env, so `pnpm install` and `npm install` in a cloned repository skipped its
+# devDependencies and every typecheck or test then failed on missing modules.
 ENV AWS_EC2_METADATA_SERVICE_ENDPOINT=http://169.254.169.254 \
-    NODE_ENV=production \
     PYTHONDONTWRITEBYTECODE=1 \
     PYTHONUNBUFFERED=1 \
     # omp env sheet: relocate the agent base to the baked container dir
@@ -239,6 +257,23 @@ RUN chmod 0755 /opt/sky/bin/export_deck
 ENV OPEN_SLIDE_HOME=/opt/open-slide \
     PLAYWRIGHT_BROWSERS_PATH=/opt/open-slide/browsers
 
+# --- Node.js, npm and pnpm (node-provider stage) -----------------------------
+# /usr/local/bin precedes the bun base's fallback directory on PATH, so `node`
+# is the real binary from here on; the build fails if it is not. pnpm is a
+# corepack shim: it runs the version a repository's `packageManager` names,
+# fetched on first use into the runtime user's cache, so no repository's pin is
+# baked into the product. The prompt corepack shows before that fetch would
+# stall a non-interactive shell.
+COPY --from=node-provider /usr/local/bin/node /usr/local/bin/node
+COPY --from=node-provider /usr/local/lib/node_modules /usr/local/lib/node_modules
+RUN ln -s ../lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm \
+    && ln -s ../lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx \
+    && ln -s ../lib/node_modules/corepack/dist/corepack.js /usr/local/bin/corepack \
+    && corepack enable --install-directory /usr/local/bin pnpm \
+    && test "$(command -v node)" = /usr/local/bin/node \
+    && node --version && npm --version && corepack --version
+ENV COREPACK_ENABLE_DOWNLOAD_PROMPT=0
+
 # /opt/sky/bin FIRST so `gh` and `aws` resolve to the wrappers, never the real
 # binaries.
 ENV PATH="/opt/sky/bin:${PATH}"

package/dist/bin/app.js

@@ -8,14 +8,17 @@ import {
   FoundationPages,
   FoundationPipeline,
   NewsletterStack
-} from "../chunk-efqdhd2e.js";
+} from "../chunk-59dpqyap.js";
+import"../chunk-pxhftba1.js";
+import"../chunk-dz91avrb.js";
 import {
   adminsFor,
   instanceNames,
   loadInstanceFile,
   provisionsIntegration
-} from "../chunk-gnz747z2.js";
-import"../chunk-dz91avrb.js";
+} from "../chunk-rxetj2p9.js";
+import"../chunk-96fjaysn.js";
+import"../chunk-5wgwscd0.js";
 
 // bin/app.ts
 import * as cdk from "aws-cdk-lib";